Research
(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
Publication date not yet evaluated · Added · 2 reports arxiv.org
Page published
Coverage timeline
Why it matters
The demonstrated attack chain shows that autonomous mobile agents blindly trust screen content their vision models can see but users cannot, letting an unprivileged app achieve arbitrary command execution and exposing a fundamental trust mismatch in agent design.
Researchers from Simon Fraser University, CUHK, Shandong University, and QAX's Xingtu Lab (arXiv:2607.00333) demonstrated seven concrete attacks against five open-source mobile AI agent frameworks—AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA—exploiting new attack surfaces in VLM-driven mobile agents. A malicious Android app with no special permissions can inject subliminal, human-invisible on-screen text that the agent's vision model reads, hijacking agent actions and chaining to arbitrary command execution on the host PC driving the agent. Each framework fell to at least six of the seven attacks; the authors report no evidence of the techniques being used outside a controlled setting and no CVEs are assigned.